https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:58:01.617646+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2022-avi-387 certfr-2022-avi-387 — Une vulnérabilité a été découverte dans Nextcloud Server. Elle permet à un attaquant de provoquer une exécution de code… 2026-10-05T18:58:01.621329+00:00 certfr-2022-avi-387 https://cve.radiocsirt.org/vuln/euvd-2026-32569 EUVD-2026-32569 2026-10-05T18:58:01.621365+00:00 EUVD-2026-32569 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43608 fkie_cve-2021-43608 2026-10-05T18:58:01.621379+00:00

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.

 https://cve.radiocsirt.org/vuln/ghsa-r7cj-8hjg-x622 GHSA-r7cj-8hjg-x622 — DBAL 3 SQL Injection Security Vulnerability 2026-10-05T18:58:01.621406+00:00

Affected: Packagist: doctrine/dbal

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.

We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.

The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling `AbstractPlatform::modifyLimitQuery`.

As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.

This vulnerability has been assigned [CVE-2021-43608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43608).

 https://cve.radiocsirt.org/vuln/gsd-2021-43608 gsd-2021-43608 2026-10-05T18:58:01.621443+00:00 gsd-2021-43608 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43608 UBUNTU-CVE-2021-43608 2026-10-05T18:58:01.621455+00:00

Affected: Ubuntu:16.04:LTS: php-doctrine-dbal

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.